Kiran 
Broadcom has shipped urgent patches for seven vulnerabilities affecting VMware Avi Load Balancer, including a maximum-impact authentication bypass flaw that scored 9.8 on the CVSS scale.
The advisory, tracked as VMSA-2026-0005, went live on July 14, 2026, and covers CVE-2026-47865 through CVE-2026-47871 a mix of authentication bypass, remote code execution, privilege escalation, and directory traversal bugs that together give attackers a near-complete attack chain against exposed Avi Controllers.
Given Avi Load Balancer’s role sitting at the edge of enterprise application delivery infrastructure, unpatched instances present a high-value target for network-based attackers.
The Critical Flaw: CVE-2026-47865
The standout issue is CVE-2026-47865, an authentication-bypass vulnerability with a CVSSv3 score of 9.8. Broadcom’s advisory states that a “malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism,” meaning no credentials are required to reach administrative functionality.
Notably, this flaw only affects versions 22.1.1 through 31.2.2; the 32.1.1 branch is unaffected by this specific CVE, though it remains vulnerable to the other six.
The remaining six vulnerabilities range from 7.1 to 8.8 in severity, and several are particularly dangerous when combined with the authentication bypass:
- CVE-2026-47866 (8.3): Authorization bypass allowing limited, unauthorized access to the control plane.
- CVE-2026-47867 and CVE-2026-47869 (both 8.7): Remote code execution flaws: one requiring only network access; the other exploitable by an authenticated user who injects code.
- CVE-2026-47868 (7.8): Local privilege escalation enabling root-level code execution.
- CVE-2026-47870 (7.1): Authenticated privilege escalation leading to remote code execution.
- CVE-2026-47871 (8.8): Directory traversal stemming from improper file path validation.
The practical concern for defenders is chaining: an attacker exploiting the unauthenticated CVE-2026-47865 could then pivot into RCE or privilege-escalation bugs that normally require authentication, effectively turning a “low-privilege” flaw into a full compromise path.
Affected Versions and Fixes
Broadcom’s response matrix lays out fixes across four version branches:
- Versions 22.1.1–22.1.7 and 30.1.1–30.2.6: Upgrade to 30.2.7.
- Versions 31.1.1–31.2.2: Upgrade to 31.2.2-2p3.
- Version 32.1.1: Upgrade to 32.1.2 (recommended, latest release).
Critically, no workarounds exist for any of these seven vulnerabilities. Patching is the only remediation path, and organizations still running the legacy 22.1.x branch must upgrade directly to at least 30.2.7, since that branch has aged out of independent fixes.
Broadcom credited Filip Waeytens of the NATO Cyber Security Center (NCSC) for reporting the authentication bypass, authorization bypass, and both RCE flaws, while Lang Khuong Duy of Viettel IDC is acknowledged for identifying the privilege escalation and directory traversal issues.
The involvement of a NATO security body underscores the geopolitical stakes of vulnerabilities in load-balancing infrastructure, which often sits in front of government and critical-infrastructure applications.
Given the 9.8 severity score and the absence of workarounds, security teams operating Avi Load Balancer should treat this as an emergency patching cycle rather than routine maintenance:
- Inventory all Avi Controller instances and identify their current version.
- Prioritize upgrades for any controller reachable from untrusted or broader internal networks.
- Apply 32.1.2, 31.2.2-2p3, or 30.2.7 depending on the current branch.
- Review Avi Controller access logs for anomalous authentication or control-plane activity predating the patch.
With proof-of-concept exploits historically following VMSA disclosures within weeks, delaying remediation on internet-facing or broadly accessible Avi deployments carries substantial risk.
About the Author
Potheeswaran 
